MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 00d8ecff83115efe2fa1d2cdbd399f5c5004461d4bfae7fa3fb22eb86b640ee5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	00d8ecff83115efe2fa1d2cdbd399f5c5004461d4bfae7fa3fb22eb86b640ee5
SHA3-384 hash:	8b575e0a299344d8f1d46ddffe8999af542eca3416fbdc83768675b55b7d80b0eb2fb4873db9f1512fe96278314d5cfd
SHA1 hash:	ef838c9efd93217ce427d7975e61271b704abadd
MD5 hash:	50e5aeeeb79ff81c35c7d8d12348fa3a
humanhash:	wolfram-summer-oklahoma-zulu
File name:	00d8ecff83115efe2fa1d2cdbd399f5c5004461d4bfae7fa3fb22eb86b640ee5
Download:	download sample
Signature	Dridex Create hunting rule
File size:	880'640 bytes
First seen:	2021-03-16 05:17:40 UTC
Last seen:	2021-03-16 06:49:12 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	8ce5cf6636b690adc707814c2493aa70 (4 x Dridex)
ssdeep	24576:FD/SO6D+/lmOOlMuR7hdMbVlo+MbLY+Om+FmzP:FD/SBiAOOjtW3o+MbLSkr
Threatray	538 similar samples on MalwareBazaar
TLSH	0915DF41B982EA78D40290B5DE8CCDFE094CFF45CE692A5370C97F9F73781A4623A529
Reporter	Cryptolaemus1
Tags:	10444 Dridex

Cryptolaemus1

Dridex 10444

Intelligence

File Origin

# of uploads :

# of downloads :

125

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.Win32.Save.a.1139.7457.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Sending a custom TCP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Dridex

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/77b38f80-cece-4763-a3cd-b4fb42c3f038

Result

Threat name:

Dridex

Detection:

malicious

Classification:

troj

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/640292

Signature

C2 URLs / IPs found in malware configuration

Found malware configuration

Yara detected Dridex unpacked file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/00d8ecff83115efe2fa1d2cdbd399f5c5004461d4bfae7fa3fb22eb86b640ee5/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=admoz74dcfpp4l5b2lg32om7lriairq5jp5op6r7wixlq23eb3sq._file

Verdict:

malicious

Label(s):

dridex

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:10444 botnet discovery evasion loader trojan

Link:

https://tria.ge/reports/210316-13d3hfda96/

Behaviour

Suspicious use of WriteProcessMemory

Checks installed software on the system

Checks whether UAC is enabled

Blocklisted process makes network request

Dridex Loader

Dridex

Malware Config

C2 Extraction:

210.65.244.184:443
147.78.186.4:10051
62.75.168.152:6601

Unpacked files

SH256 hash:

1c9e7214d223dbfcef229f113e45128ccb571080a3d8ba9f0b6da675a19b38ce

MD5 hash:

4b9a8194ca41098b7edf50462adfe3c1

SHA1 hash:

267882bcae65adbc9a9898dd6155df66b9d39f4e

Link:

https://www.unpac.me/results/babd4fd5-61f9-4da1-bf04-71e26919c8b8/

SH256 hash:

00d8ecff83115efe2fa1d2cdbd399f5c5004461d4bfae7fa3fb22eb86b640ee5

MD5 hash:

50e5aeeeb79ff81c35c7d8d12348fa3a

SHA1 hash:

ef838c9efd93217ce427d7975e61271b704abadd

Link:

https://www.unpac.me/results/babd4fd5-61f9-4da1-bf04-71e26919c8b8/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/00d8ecff83115efe2fa1d2cdbd399f5c5004461d4bfae7fa3fb22eb86b640ee5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.